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We introduce symmetric extensions of bipartite quantum states as a tool for analyzing protocols that dis- 
till secret key from quantum correlations. Whether the correlations are coming from a prepare-and-measure 
quantum key distribution scheme or from an entanglement-based scheme, the protocol has to produce effective 
states without a symmetric extension in order to succeed. By formulating the symmetric extension problem 
as a semidefinite program, we solve the problem for Bell-diagonal states. Applying this result to the six-state 
and BB84 schemes, we show that for the entangled states that cannot be distilled by current key distillation 
procedures, the failure can be understood in terms of a failure to break a symmetric extension. 



PACS numbers: 03.67.Dd, 03.67 .Mn 

I. INTRODUCTION 

An important quantity characterizing the performance of 
a quantum key distribution (QKD) scheme is the maximum 
amount of channel noise which can be tolerated before the 
protocol fails to produce a secure key. 

This threshold has clear implications for QKD as a 
potentially-realizable technology and not just as a possibil- 
ity inherent in the formalism of quantum mechanics. It also 
relates to an important issue of principle, namely, the connec- 
tion between quantum mechanics and privacy. What aspects 
of quantum mechanics are responsible for the possibility of 
key distribution and other cryptographic protocols? Determin- 
ing the threshold, or at least bounding it, gives us insight into 
this issue. Particular properties of quantum states and chan- 
nels which are sufficient for generating privacy in some way 
lead to lower bounds, while identifying properties necessary 
for privacy leads to upper bounds. 

One such property is the symmetric extendibility of bipar- 
tite quantum states. Suppose that two honest parties Alice and 
Bob share a state p AB from which they would like to extract 
a secret key using one-way public communication from her 
side to his. This task is impossible should there exist a tripar- 
tite state p ABB such that the AB' marginal state is identical 
to the AB marginal p AB = p AB . If such a state exists it can 
always be chosen to be symmetric between B and B' , i.e., the 
state is invariant when B and B' are swapped. Such a tripar- 
tite state is called a symmetric extension of the original state, 
and the equality of the marginals means that the extra system 
B' essentially functions as a copy of system B. Assuming the 
worst-case scenario that an eavesdropper Eve holds B' , what- 
ever process Bob uses to create an error free bit string after re- 
ceiving the communication from Alice can also be performed 
by Eve, and thus the bit string cannot be private [1]. 

The question of symmetric extendibility is relevant in many 
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areas of quantum information theory, from Bell-inequalities 
[2] to quantum channel capacity [3]. In QKD, the neces- 
sary condition of not having a symmetric extension has been 
translated into upper bounds on the key rate and threshold 
noise rate for one way procedures in [1]. A considerable ad- 
vantage of this approach stems from the fact that the upper 
bounds are determined without having to construct concrete 
eavesdropping attacks. Moreover, for systems described by 
Hilbert spaces of modest dimension, symmetric extensions 
can be efficiently constructed — when they exist — by means 
of semidefinite programming. 

In this paper, we consider the case of two-way commu- 
nication and use the symmetric extension to derive attack- 
independent upper bounds for the BB84 [4] and six-state [5] 
schemes. At first glance, symmetric extensions appear to be 
irrelevant to the problem, since the two-way nature of the 
communication creates an asymmetry between the honest and 
dishonest parties — Eve cannot pretend to be one of the hon- 
est parties. However, every two-way communication proce- 
dure consists of alternating rounds of one-way communica- 
tion, which must eventually terminate if the protocol is to es- 
tablish a secret key that can be used in other applications. The 
final step thus involves only one-way communication, and the 
question of symmetric extendibility again becomes relevant. 
From this point of view, it becomes clear that the goal of the 
two-way communication is to break any existing symmetric 
extension of the input state. 

To avoid confusion, we distinguish between a QKD proto- 
col, a QKD scheme, and the various procedures such as advan- 
tage distillation, error correction, and privacy amplification. 
By a QKD scheme, we mean the generation of correlated data 
by distributing quantum particles and measuring them. For 
simplicity we will also include the parameter estimation and 
sifting in the definition of the scheme. Including the sifting 
means that BB84 [4] and SARG04 [6] are different schemes, 
even though the signal states and measurements are the same. 
For a given scheme, the key distillation procedures following 
it can be chosen in different ways which give different thresh- 
olds. We call the whole process a QKD protocol, so that at the 
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end of the protocol the parties have a secret key that is ready 
for use. 

Given a particular two-way procedure, then, the question of 
symmetric extendibility leads to an upper bound on the noise 
threshold given by the noisiest state for which the procedure 
just fails to break the extension. Generally one must resort 
to finding an approximate symmetric extension by solving 
the semidefinite program numerically. For the well-known 
BB84 [4] and six-state [5] schemes, however, the relevant 
states can be assumed without loss of generality to be diago- 
nal in a basis of maximally entangled states: the so-called Bell 
basis. By making use of the symmetries of the Bell states, we 
can answer the question of symmetric extendibility by solv- 
ing the semidefinite program analytically, which then leads to 
exact upper bounds for the tolerable error rates. For the two- 
way procedure outlined by Chau [7], we show that the up- 
per bound for the two schemes meets the lower bound given 
therein and that this procedure is optimal for a wide range of 
two-way procedures. This agrees with the results reported by 
Acm et al. [8], who based their upper bound on an explicit 
eavesdropping attack. 

Our results are organized as follows. In Sec. II, we examine 
in detail the role played by the symmetric extension in two- 
way QKD protocols. In Sec. Ill we review the formulation of 
the symmetric extension problem as a semidefinite program 
(SDP), simplify, and solve it for Bell-diagonal states and give 
an analytic expression for the boundary of extendible Bell- 
diagonal states. Section IV describes Chau's two-way com- 
munication procedure and shows that above the known lower 
bound on the threshold, the procedure fails to break the sym- 
metric extension and can therefore not lead to a secret key. We 
also discuss variations of this procedure which turn out to be 
equivalent for distillability. In Sec. V we sum up and discuss 
some open questions. 

II. BREAKING SYMMETRIC EXTENSIONS 

One goal of the portion of a QKD protocol involving two- 
way communication is to transform a state having a sym- 
metric extension into one which does not. In a prepare and 
measure (P&M) scheme, there is never an actual bipartite 
entangled state, but any such scheme can be modeled as an 
entanglement-based scheme where Alice prepares an entan- 
gled state and sends half of it to Bob. When Alice measures 
her half of the entangled state, this effectively prepares the 
other half in one of the signal states of the P&M protocol [9]. 
Eve may interfere with the transmitted signal in any manner 
of her choosing, so after making their respective measure- 
ments, Alice and Bob compare a portion of the data in or- 
der to determine — at least roughly — what particular quantum 
state p AB they share. This state is the starting point for our 
analysis and is any state obeying 

p jk = Tr [p AB (Aj ® B k )) , (1) 

where Aj and Bk are the POVM elements of Alice's and 
Bob's respective measurements and pj k are the probabilities 
with which Alice and Bob obtain outcomes corresponding to 



Aj and Bk, respectively. Any subsequent processing of the 
measurement data is then modeled as a coherent processing 
on the quantum states with any classical communication cor- 
responding to measurement outcomes. This allows us to track 
the effective state throughout the protocol. 

Now we can investigate which two-way processing proce- 
dures can break symmetric extensions. By making a few as- 
sumptions on the form of the procedure, we can simplify the 
problem considerably. Assume that each round of one-way 
processing is performed on blocks with a finite number of sys- 
tems, such that the output is considered as a single system in 
the next round. As we are not concerned with the rate of dis- 
tillation, only whether the state is at all distillable or not, we 
are led to the following two simplifications. 

First, we only need to concern ourselves with filtering 
operations — quantum operations defined by a single Rraus 
operator — which do not always succeed when applied to a 
state. There is a corresponding Kraus operator for failure, 
which makes the operation trace-preserving, but we discard 
the failure outcomes and therefore a filter is in general not 
trace-preserving. If p AB is the state of the block before 
postprocessing, the unnormalized state after Bob applies the 
filter K is (1 <g> K)p AB (l ig) K)^ and the filter satisfies 
K'K < 1. If an operation with more than one Kraus op- 
erator is able to break the symmetric extension — that is 
5^.(1 <g> K 3 )p AB (l <g> Ktf (where £\ k\k s < 1) has no 
symmetric extension — then because of convexity at least one 
of the ( 1 <g> K 'j ) p AB ( 1 (g) K 3 ■) * must be without symmetric ex- 
tension, so the filter Kj alone will break the extension. 

Second, we can reduce the finite number of one-way rounds 
to only two, for the following reason. Assume that the final 
round of communication is from Alice to Bob. Bob can start 
the procedure already at his last round by guessing ahead of 
time what Alice's messages related to that block would have 
been and perform the corresponding local operations. Usually 
this guess will be wrong and Alice will tell Bob to discard 
those blocks in the final round. For the tiny fraction of the 
blocks where Bob guessed correctly, Alice can proceed with 
her last round. This means that if the symmetric extension 
can be broken during a two-way procedure, it must also be 
possible to break it with a single filter on a block of copies of 
Bob's system. 



III. EXTENDIBILITY OF BELL-DIAGONAL STATES 

Bell-diagonal states are two-qubit states that are diagonal 
in the basis of maximally entangled states l^*) = ^g(|00) ± 
|11)), |^±) = -3_(|01) ± 1 10>). Such states can be pro- 
duced by sending half of the maximally entangled state |3> + ) 
through a Pauli channel with error probabilities p x , p y , and p z 
for the <j x , <j y , and cr z errors respectively. This results in the 
stated = p/|$+}<$+| +p x |* + )<*+| +p y \^-)(^-\ + 
p z \&~}(&~\, where pi = 1 — p x — p y — p z . For com- 
pactness, we will also denote this as p AB = Pj\Pj)(Pj\ 
where the index j runs over the set {/, x, y, z} or equivalently 
{0,1,2,3}. 
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In the six-state and BB84 QKD schemes considered here, 
the effective quantum states describing the systems held by 
Alice and Bob can be taken to be Bell diagonal for the fol- 
lowing reason. First, Alice and Bob discard all data from 
mismatched bases, and they can assume the worst case sce- 
nario which is that the corresponding outcomes are com- 
pletely uncorrelated. This implies Tr[p AB (a A ® cr 3 )] = 
for i 7^ j, i,j 7^ 0, where <7j are the Pauli operators. Fur- 
ther, Alice and Bob randomly (but jointly) decide which state 
in each basis corresponds to which bit value, so the corre- 
lations in each basis are characterized by a single error rate 
qj = 1 — po — pj for j € {1,2,3}. From this condition, it fol- 
lows that Tr[p AB (af ® I s )] = Tr[p AB (l A <g> erf)] = for 
i ^ 0, and this leaves only Oi ® Ci, and it is easy to verify that 
this means the state is Bell diagonal. In the six-state scheme, 
there are three bases, so the corresponding error rates deter- 
mine the Bell-diagonal state completely. In the BB84 case, 
the error rate in the y basis is not known, leaving an equiva- 
lence class of possible states. 

The Bell-diagonal states have a number of appealing and 
useful properties. For instance, it is possible to reduce any 
bipartite qubit state to the Bell-diagonal form by "twirling," 
choosing a Pauli er,; and applying a A (g> a B on the state 
[10]. Generic two-qubit states can also be filtered to the Bell- 
diagonal form with a two-side filtering [11]. Finally, any two- 
qubit state where both reduced states are maximally mixed is 
Bell-diagonal with the right choice of local basis [12], and a 
local change of basis can also rearrange the Pj in any order. 

For our purposes, a parametrization different from the pj 
will be useful. The analysis of both symmetric extension and 
key distillation is simplified using the following parameters: 



= Pi +Px +P y +Pz, (2a) 

ol\ =Pi ~Px ~Py +Pz, (2b) 

a 2 = V2(pi -p z ), (2c) 

a 3 = V2(ftr ~Py), (2d) 
which gives the inverse transformation 

Pi = tOo + c*i + V2a 2 ), (3a) 

Px = j(o!o - "I + V2a 3 ), (3b) 

Py = l(ao - at - V2a 3 ), (3c) 

Pz = \{a + ai - V2a 2 ). (3d) 



Because of normalization, o = 1 for all probability vec- 
tors. So all Bell-diagonal states are uniquely defined by 
the coordinates (01,012,0:3). The maximally entangled 
states are in these coordinates l^*): (l,±\/2, 0) and l^*): 
(—1, 0, ±\/2). The convex hull of these four points is a tetra- 
hedron, which represents the set of Bell-diagonal states. This 
region is defined by the four inequalities 

oi±V2o 2 >-l and - oi ± %/2o 3 > -1, (4) 

each corresponding to a particular eigenvalue being non- 
negative. 



A. Formulation as a semidefinite program (SDP) 

Recall that a state p AB has a symmetric extension if there 
exists a state p ABB ' which is such that Tr B '[p ABB ] = p AB 

and V B b'P ABB 'vIb' ~ p ABB ' , where Vbb> is the unitary 
operation swapping B and B' . The question of whether or 
not p AB has a symmetric extension can be formulated as a 
semidefinite program (SDP) [13, 14]: a convex optimization 
of a linear function over the convex cone of positive matri- 
ces. These can be efficiently solved numerically for low- 
dimensional systems using interior point algorithms [15, 16]. 
The following discussion is adapted from [16]. Consider the 
following maximization, a semidefinite program: 

maximize 1 - Tr[X ABB '}, 

subject to Tr[L ABB 'X ABB '] = Tr[L AB p AB ], 

X ABB ' > 0. (5) 

The free variable to be optimized, X ABB , is an operator on 
Ha ®Hb®Hb* , and {L AB } is a basis for traceless operators 

on H A ® U B . Further, L ABB ' := Sym B B>(Lf B ® for 
Sym B B> trie quantum operation symmetrizing systems B and 
B', Sym B B>(M ABB ') := (M ABB ' + V BB > M ABB 'vl B ,)/2 
using the swap operator Vbb'- 

If the optimum value of the objective function is non- 
negative, a suitable multiple t (> 0) of \ ABB can be 
added to X ABB in order to satisfy the normalization con- 
dition Tr[X ABB ' + tl ABB '} = 1, and the extension is then 
given by p ABB ' = Sym BB '{X ABB ' + tl ABB '). This sym- 
metrization ensures that Vbb'P ABB ^bb' = P ABB ■ To 
see that the constraints on X ABB in the SDP ensure that 
Tr B'[p ABB ] — p AB , we use the facts that for any opera- 
tors M AB and N ABC , we have that M AB Tr c [N ABC ] = 
Tr c [(M AB ® 1 C )N ABC ] and that for any P ABC and Q ABC , 

TT[P ABC Sym BC (Q ABC )} = Tr[Sym BC (P ABC )Q ABC }- 
We then get that for all i, 

TiiL AB T rB '[SymBB'(X ABB ')}} 

= Trl(L AB ®l B ')Sym B B>(X ABB ')} 
= Tr[Syta B B'(L AB ®l B ')X ABB '] 
= Tr[L AB p A % 

where the last equality is from the constraint of the SDP 
(5). Since {Lf B } is a basis for the traceless operators 
on Ha <S> Hb, we therefore have that the traceless part of 
TrB>[Sym B B>(X ABB ')} is equal to the traceless part of p AB . 
Also, Ti-[p ABB '} = Tr[p AB ] = 1, so Tr B '[p ABB '} = p AB . 

If the maximum value is negative, no positive semidefinite 
extension can be constructed because if p ABB were a sym- 
metric extension of p AB , the choice X ABB = p ABB would 
satisfy the constraints and give the objective function a value 
ofO. 

To every SDP, there is an associated dual SDP which for 
the symmetric extension problem is somewhat easier to work 
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with. The dual of Eq. (5) is 

minimize Tr[K AB p AB ], 
subject to K ABB ' > 0, 



(6) 



where K AB := 1 



AB 



K 



ABB' 



Sym BB ,(K AB ® I s ), and lj are free variables to be op- 
timized. We refer to this optimization as the dual prob- 
lem and the original optimization (5) as the primal problem. 
Should p AB have a symmetric extension, Tr[K AB p AB ] = 
Tr[K ABB ' p ABB '] > 0, since the trace of the product of 
two positive operators is non-negative. Thus a sufficient con- 
dition for p AB not to be extendible is for the minimum of 
Tr[K p 1 ] to be negative. As we discuss below, this con- 
dition is also necessary, due to a property known as strong 
duality. 

Weak duality holds that the optimum value of the primal 
problem is always less than the optimum of the dual, which 
follows from the positivity constraints, 

Tr[K AB p AB ] - (1 - Tr[X ABB '}) 

= Tv[K ABB 'x ABB '} > 0, (7) 



where the equality follows from Tr[K p ] 
Tr[K J 



ft 



ABB' 



)] 



''ABB' pABB'^ _ r £x[K ABB ' (X ABB ' 

and 1 - Tr[X ABB '] = Tr[tl ABB ']. 

Strong duality is the statement that the optimum values of 
the primal and dual problems are equal. Sufficient conditions 
for strong duality are known. In particular, a semidefinite pro- 
gram is said to be strictly feasible if the constraints can be 
satisfied by a matrix that is positive definite rather than just 
positive semidefinite. The strict feasibility of either the pri- 
mal or dual semidefinite programs is sufficient to guarantee 
strong duality (theorem 3.1 [13]). If both the primal and the 
dual are strictly feasible then we are also guaranteed that there 
exist matrices X ABB and K ABB that satisfy the constraints 
and attain the optimum of the primal and dual program, re- 
spectively, (theorem 3.1 [13]). 

The dual problem is obviously strictly feasible just by tak- 
ing K AB = t AB . On the primal side, note that there must 
be some, not necessarily positive, X ABB meeting the con- 
straints, since these underdetermine the components. As the 
constraints only involve the traceless part of X ABB , a suit- 
able multiple of the identity \ ABB can always be added 
to ensure positivity. From strict feasibility, we obtain the 
sufficiency condition that min(Tr[K AB p AB )) > implies 
p AB is extendible 1 . Moreover, when the optima are equal, 



Tr[K ABB 'X ABB '} = 0, and hence K ABB ' X ABB ' = 0. 
This condition is termed complementary slackness and will 
play an important role in the analytical solution. 



1 In this manner, the dual SDP constructs a witness for the (lack of) symmet- 
ric extension, a Hermitian operator K AB which defines a hyperplane in 
the set of positive operators separating the given state p AB from the con- 
vex set of extendible states [17]. Strict feasibility implies that we only need 
to consider Hermitian K AB for which K ABB ' > 0. 



B. Simplifying the SDP for Bell-diagonal states 

Now consider the dual form of the SDP, [Eq. (6)]. By ex- 
ploiting the symmetry of the problem, we can find an ana- 
lytic solution. The method for dealing with symmetry follows 
the general prescription of Gatermann and Parrilo [18], but 
takes advantage of several special properties of this problem. 
Because p AB is Bell diagonal, it is invariant under conjuga- 
tion by Pauli operators Ci <g> . This induces a symmetry of 
the objective function, since Tr^er,; (g) ai)K(a{ <g> er^ p] = 
Tr[Kp] for any i E {0,1,2,3}. Moreover, the constraint 
K ABB = Sym BB ,(K AB ® t B ') > is equivalent to 
Sym BB /((cri <E> a i )K AB (a i <E> cr i ) t <g> I s ') > 0. Hence, the 
set of allowable K is invariant under arbitrary conjugation by 
Pauli operators and since they all yield the same value of the 
objective function, we can focus on those formed by the con- 
vex combination K = \ X)i=o( cr « ® fJ i)^( cr i ® a i)^ without 
loss of generality. Since K is a "twirl" of K, it is also Bell di- 
agonal: K = J2j kj\(3j)(f3j\. The kj satisfy J2j kj — 1> since 
Tr[^] = Tr[(cr 4 ® a l )K(a l ® fj i )t] = 1, but not necessarily 
kj > 0. This simplifies the objective function Tr[K AB p AB ] 
to J^j kjPj w i tn tn e additional constraint J2j kj = 1- 

Next, we would like to use the symmetry of K to simplify 
the constraint K ABB > 0. For readability, we will — in this 
and the next two paragraphs — write the Pauli operators as X, 
Y, and Z, and tensor products such as 1 (g) a x ® a z as IX Z. 
Observe that K inherits invariance under the operators XXX 
and ZZZ from K. We can simplify the calculation by observ- 
ing that XXX and ZZZ are logical operators for the bit-flip 
code. Because of the symmetry, it will be necessary for K 
to be proportional to the identity on the code space. K has a 
symmetry under swapping B and B' that we will also wish 
to take advantage of. We can proceed by identifying three 
"logical" or encoded qubits F, G, and H on the Hilbert space 
TLa ®Wb ® Hb', such that the form of K is simpler when 
expressed in the computational basis of Tip <8> Hg <8 T~Lh ■ The 
encoded X- and Z-operators on the logical qubits are 



Xp \ — X XX : 
Zp '.= ZZZ, 



X G XIX, 
Z G := ZZI, 



X H := XXI 
Z H := ZIZ. 



Note that with these definitions swapping B and B' induces 
a swap on G and H . It is simple to verify that the Pauli op- 
erators on different logical qubits commute and that X and Z 
anticommute on the same logical qubit. They therefore define 
a valid encoding, and the encoded product vectors \ijk)pcH 
are the eight simultaneous eigenvectors of the encoded Z op- 
erators, 



\000)fgh = \000)abb', |100) fgh = |111)abb', 

\00l) FGH = \1W)abb<, \W1)fgh = |001) A bb', 

\010) FGH = \101) AB b>, \n0) FGH = |010)asb', 

\oii) FGH = \on) ABB ,, \m) FGH = \ioo)abb>. 



(8) 



Since K is invariant under the operators XX X and ZZZ, 
we can immediately infer that K ~ lp ® K' GH . Further- 
more, K is by definition invariant under swapping the BB' 
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systems, and swapping BB' is the same as swapping GH. 
This means that K' GH must be block diagonal with the sup- 
port on the triplet and singlet subspaces. Since K is Bell di- 
agonal and Sym BB / is a linear superoperator, we can write 
K = Y^j kjSym BB i(\(3j)([3j\ ® 1 B '). Converting the terms 
Sy m BB' (\ftj) \ ® l-B') mto operators on the logical qubits 
can be accomplished by writing it out in the computational 
basis and using the relations (8). 

Alternatively, the conversion can be done by noticing that 
ZZI and XXI are encoded Z and X operators for logical 
qubits G and H, respectively. Thus, |<i> + ) ($ + 1 ab <S> 1 B ' is on 
the +1 eigenspace of both Z G and X H , i.e., |4> + )($ + |ab ® 
1 B / ~ 1 F <g> |0+)(0+| GB . For j* - )^, we use that 
|*-)<*-Ub ® 1 B ' = (ZII)(\$+)($+\ AB ® lflO^i) 1 , 
and since Zi7 commutes (anticommutes) with ZZI (XX/), 
|<E>~)(<1>~|ab ® 1b' is on the +1 (-1) eigenspace of ZZI 
(XXI). Therefore, \ab®1 b > - 1f®|0-) (0-\gh- 

Similarly, \^ + }ab and \^~)ab correspond to \1+)gh and 
|1— )ghi respectively. Applying the swap symmetrization 
Sym BB / to \(3j)(f3j \ <8> 1 B ' is simple given this concrete rep- 
resentation, and the results have the following form. First, 
each of the terms has the form Sym BB /(|/3j)(/3j| ® 1 B /) ~ 
|lirg) (Rj © ^g//)' w h ere -Rj has support only on the triplet 
subspace. A simple calculation shows that the R matrices are 
given by 



R$>± = 




(9) 



(10) 



in the basis {|00), |*+), |11)}. 

The semidefinite program (6) now becomes 

minimize ^ i=0 &iPi, 
subject to Yh=o k i R i ^ °> 



(11) 



i. 



where {p^} ({fci}) are the eigenvalues of p (K). The latter 
constraint can be eliminated by a further change of variables 
according to Eq. (2) for both pi and ku so that p — > a and 
k — > The latter constraint now becomes simply xq = 1, 
and only x\, x%, and 2:3 remain as free variables. The ob- 
jective function becomes {x^olq + Y^j=i x j a j)/^- Instead of 
minimizing this directly, we multiply by 4 and subtract the 
constant term xoao = 1. This gives us the following much- 
simplified dual SDP which is equivalent to SDP (11) except 
for a rescaled and shifted objective function, 



minimize xj ctj , 

3=1 



(12) 



subject to F(x) = F + V] x.,Fi > 0, 



using the matrices 



F 












(: 


1 


i) 















1 






(! 




















If the minimum value of the objective function is greater than 
or equal to — 1, the state has a symmetric extension. Because 
of the minimization, finding an x that satisfies the constraints 
and such that the objective function is less than — 1 is sufficient 
to show that the state does not have a symmetric extension. 

We can find the simplified form of the primal problem by 
taking the dual of the SDP ( 1 2) 



minimize Tr [Z] , 
subject to Tr[FiZ] 
Z>0, 



OLi 



(13) 



where again the state has a symmetric extension when 
Tr[Z*] < 1. We use * throughout to denote an optimal value 
of a variable. Finding any Z that satisfies the constraints and 
has trace less than or equal to 1 is sufficient to show that the 
state has a symmetric extension. 



C. Analytical solution of the SDP 

In this section we will solve the simplified semidefinite pro- 
gram using both the primal form (13) and the dual form (12). 
For the states which have a symmetric extension, we prove 
this by finding an explicit Z with Tr[Z] < 1 which satisfies 
the constraints of the SDP (13). When the state has no sym- 
metric extension, this can be proven by finding an x such that 

the constraints of (12) is satisfied and Ej=i x j a j — ~ 1> b ut 
we will not use this. 

As shown in Sec. Ill A, the optima Z* and F(x*) from the 
primal and dual problems obey the complementary slackness 
condition 



F(x*)Z* = 0, 



(14) 



and it is this condition that allows us to solve the semidefinite 
program analytically and prove that certain states do not have 
a symmetric extension. The first simplification we get from 
condition (14) is that rank[F(x*)] + rank(Z*) < 3 since 
F(x*) and Z* must have support on orthogonal subspaces. 
Since both F(x*) = and Z* = are excluded by the con- 
straints, at least one of F(x* ) and Z* must have rank one. 

The solution will proceed as follows. We first consider Z 
of rank one. This will give us a sufficient condition for a sym- 
metric extension. We then consider the case when this condi- 
tion is not satisfied. Under the assumption that the state still 
has a symmetric extension, we use complementary slackness 
to show that there can only be four possible Z*. If none of 
these candidates satisfy Z > 0, we get a contradiction and the 
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state cannot have a symmetric extension. It turns out that the 
candidates all satisfy Tr[Z] < 1, though, so if one of them 
also is positive semidefinite, it also proves that the state has a 
symmetric extension. 

Start by finding the possible values for the objective func- 
tion when Z is rank one. From the constraints Tr^Z] = a, 
of the primal problem, Z has the form 



1 



f 2(ai + z 33 ) a 2 2z 13 \ 
Z = - ! a 2 2z 22 a 3 

2z 13 a 3 2z 33 1 



(15) 



The objective function is the trace of this matrix, so we want 
to determine z 2 2 and z 33 from the rank-one condition. Since 
Z is real and symmetric, we can parametrize its eigenvector 
with three real numbers aj. This gives an alternative charac- 
terization of Z, 



aiQ2 a\a 3 



ai 
aiQ2 



a\a 3 a 2 a 3 



a n 



a 2 a 3 



(16) 



and we can solve the problem by equating these. Taking the 
ratio of the 1,2 and 2,3 elements, we get ai/a 3 = a 2 /a 3 
when a 2 , a 3 , a 3 ^ 0. The ratio of the 1,1 and 3,3 elements is 
the square of this, which implies that z 33 — a 2 = aia 2 /(a 2 — 
a 2 ). Now use the fact that the square of the 2,3 element equals 
Z22Z33 to find z 2 2 — («2 — a i)/4ai. The objective function 
is then 



Tt[Z] = 



(a 2 -a 2 ) 2 + 4a 2 (a 2 + a 2 ) 



4ai(a2 



(17) 



and since it is fixed by the state (and the requirement that Z 
be rank one), no minimization is required. If this expression 
is less than or equal to 1, the state has a symmetric extension 
since Tr[Z*] < Tr[Z]. If the value is greater than 1, we cannot 
conclude yet since it could be that Z* is of rank two and has 
trace less than or equal to one. Thus, 

A ai (a 2 2 - a\) - (a 2 2 - a 2 3 ) 2 - Aa 2 {a 2 + a 2 )>0 (18) 

is a sufficient but not necessary condition for the state to have 
a symmetric extension. 

If Eq. (18) is satisfied, we know that the state has a sym- 
metric extension, so for the rest of this section we assume 
that it is not. For a contradiction (in some cases), we now 
assume that the state has a symmetric extension. This means 
that rank(Z*) = 2 and because of complementary slackness 
rank[_F(x*)] = 1. We therefore want to find out for what pos- 
sible x we get a rank one F(x). The dual problem (12) gives 
us the form of F(x), 

'l + Xi x 2 
F(x) =(2:2 1 ^3 

x 3 1 — x\ _ 

In this case we proceed as before, expressing F(x) also as a 
projection operator of the form (16) and using relations be- 
tween the matrix elements. From the 1,3 element, it is clear 



that either a 3 or a\ must be zero. This zeroes out the first or 
third column and row, and we immediately obtain x\ = ±1 
and x 3 — or X2 = for the former and latter cases, re- 
spectively. This leaves a matrix with a non-zero 2x2 block, 
which must have determinant zero. From this we get x\ = 2 
and x 2 — 2 in the two cases, so x — (xi,X2,x 3 ) can only 
take one of the four values (1, ±\/2, 0), (-1, 0, ±\/2). The 
corresponding four values of the objective function in SDP 
(12) are 



q?i ± V2ot2 and — ai ± V2a 3 . 



(19) 



If any of these would be less than —1, we would be able to 
exclude the possibility of a symmetric extension at this point. 
However, this is not possible for any states, since the four in- 
equalities (4) defining the border of the set of Bell-diagonal 
states are saying exactly that these four values are greater than 
or equal to —1. 

The four possible candidates for x* cannot by themselves 
contradict our assumption of a symmetric extension for pos- 
sible values of a;. However, under this assumption one of 
these candidates must be optimal. There must, therefore, be a 
complementary optimal Z* of the primal problem for which 
the complementary slackness condition (14) is satisfied. For 
each of the four possible x*, we can impose the complemen- 
tary slackness condition F(x)Z = to a Z of the form 
(15), and check if the resulting Z can be positive semidefi- 
nite as required by the SDP conditions. For the two vectors 
x = (1, ±\/2, 0), this gives the two possible matrices 



Z = 



1 



2y/2 



T&2 V2&2 T«3 

^/2a 2 t2«2 V2a 3 
^a 3 V2a 3 — 2\/2aiTa2y 



(20) 



Since the second column is proportional to the first, the ma- 
trix is positive semidefinite if and only if the lower right 
2x2 block is. This is positive semidefinite if and only if 
both the determinant and one of the diagonal elements are 
non-negative. The determinant is in this case proportional to 
2(a 2 — a 2 ) ± 4v / 2aia2, so the matrix is positive semidefi- 
nite if and only if =Fa2 > and a\ — a 2 ± 2\p2a\<X2 > 0. 
The possible matrices for x = {— 1,0, ±\/2) are the matri- 
ces we get from Eq. (20) by interchanging the first and third 
rows and columns and making the substitutions a 2 <-> a 3 , 
u\ <-> — a,\. The positivity conditions are ~^ot 3 > and 
a| — a\ =F 2\[2ol\ol 3 > 0. Thus, if the state does not satisfy 
condition (18), and also none of the four positivity constraints, 



a\ - a\ ± 2^/2a l a 2 > and T ot 2 > 0, (21a) 
a 2 3 - a\ T 2V2«ia 3 > and =F a 3 > (21b) 

we cannot have rank[F(ir*) = 1], so our assumption that the 
state has a symmetric extension is contradicted. 

If on the other hand, one or more of the constraints are sat- 
isfied, there is no contradiction and the state could have a sym- 
metric extension. Actually, we can use the Z which satisfies 
Z > to prove that a symmetric extension exists. Taking the 
trace in Eq. (20) gives Tr[Z] = — a\ =F ^/2a 2 < 1, where 
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the inequality follows from the first two border inequalities 
in Eq. (4). For the Z corresponding to x = (—1,0, ±v2)> 
we can show Tr[Z] < 1 by using the other two border in- 
equalities. The Z which is positive semi definite will therefore 
satisfy all the constraints of the primal SDP (13), and since it 
gives a value of the objective function which is less than or 
equal to 1, the state must have a symmetric extension. 

Altogether, we have shown that if any of the conditions 
(18), (21a), or (21b) are satisfied, the state has a symmetric ex- 
tension, otherwise it does not. Since at least one of > 
always holds, we can combine the two options in Eq. (21a) 
into one at the cost of adding an absolute value. We can do 
the same for =Fc*3 > in Eq. (21b) and combining everything 
we get that a state has symmetric extension if and only if one 
or more of the following three inequalities hold: 



at) 



ai) 2 - Aa{{a z 2 + a 
-2V2 ai \a 2 \ >G, 
+ 2v / 2ai|a 3 | > 0. 



>0, (22a) 
(22b) 
(22c) 



The set of Bell-diagonal states with symmetric extension is 
pictured in Fig. 1. Condition (22a) describes a body that in- 
cludes the symmetric extendible states closest to the maxi- 
mally entangled states. It is, however, not convex. The con- 
ditions (22b) and (22c) describe four cones with vertex at the 
maximally mixed state and a maximal circular base on each 
face of the tetrahedron. The cones fill in the convex hull of 
the first body, so that the body of symmetric extendible states 
is just the convex hull of the body from condition (22a). 



IV. THRESHOLDS FOR QKD SCHEMES 



and both pairs are discarded. If the parity is equal, the first 
pair is kept. This step requires two-way communication since 
both parties need to know if they should keep the first pair. 
The P-step works on three bit pairs. The output bit on each 
side is the parity of the three bits. This does not require any 
communication at all, but it simulates a phase error correc- 
tion step where two qubits are measured to give a phase error 
syndrome which is sent from Alice to Bob for comparison. 
Alternatively, we can look at it as keeping the two extra qubits 
on each side in a shield system which limits Eve's knowledge 
about the key system [20] . Irrespective of how we look at it, 
a P-step does not require communication from Bob to Alice 
and can therefore not break a symmetric extension. If states 
with symmetric extension are to be distilled into secret key, 
the B-steps must break the symmetric extension, and we will 
therefore concentrate on these in the following. 

After a successful round of B-steps, the new error probabil- 
ities are [7]: 



pT 



Px = 



Pz = 



pj + p 2 z 



(pi - 


^Pz) 2 +(P X - 


^Pv) 2 




pI+pI 




(pi - 


^Pz) 2 + (Px - 


^Py) 2 




ZPxPy 




(pi - 


\-Pz) 2 + (Px - 


^Py) 2 




ZpiPz 




(PI- 


'rPz) 2 + (Px - 


^Py) 2 



(24a) 
(24b) 
(24c) 
(24d) 



To quantify how the procedure improves or deteriorates the 
ability of a state to produce a key, as defined by Eq. (23), we 
define the quantity 2 



A. The Chau protocol 

The two-way procedure to distill secret key from quantum 
correlations in a prepare and measure scheme invented by 
Gottesman and Lo [19] was proven by Chau [7] to work for 
Bell-diagonal states with error rates that satisfy 



(Pi - Pz) 2 > (Pi +Pz){Px + Py)- 



(23) 



This corresponds to a quantum bit error rate (QBER) of 
27.64% for the six-state scheme (p x = p y = p z ) and 20% for 
BB84 (p x — p z , p y = 0). In this section, we show that when 
this condition is satisfied, the procedure breaks the symmetric 
extension in a finite number of rounds, as implied by Chau's 
result. When it is not satisfied, however, the procedure can 
only output states with symmetric extension, and therefore no 
key can be distilled. This is similar to the analysis by Acm 
et al. [8], but since we know when a state has a symmetric 
extension, we do not need to construct an explicit attack. 

The procedure works by first applying a number of so- 
called B-steps (for bit error detection) then P-steps (for phase 
error correction) and in the end a one-way quantum error cor- 
recting code. The B-step works on two bit pairs. On each 
side, the parity of the bits is computed and compared to the 
other side. If the parity differs, there must have been an error 



D c := loe 



{Pl-Pzf 



(Pi + Pz){Px +Py) 



(25) 



This quantity is positive on all distillable states, negative on 
states where (pi — p z ) 2 < (pi + Pz)(p x + Py), an d zero 
on the border. By inserting the recursion relation (24) into 
Eq. (25), we see that Dc doubles for every successful B-step, 
= 2Dq. Thus, if the state starts out with negative Dq, it 
will remain negative, if it starts out being zero it will remain 
so, and if it starts out being positive it can reach an arbitrary 
positive value in a finite number of steps. We will next show 
that this allows the procedure to break the symmetric exten- 
sion when Dc > and not otherwise. More precisely, we 
will show that reaching Dc > 2 is sufficient for breaking the 
symmetric extension, whereas all states with Dc < have a 
symmetric extension. 

To show this, we describe the states by the same param- 
eters a that we used in the symmetric extension calcula- 
tion and defined in Eqs. (2). In these coordinates, Dc = 



2 We do not care about the rate, so we expect no relation between Dq and 
the key rate. It is possible to have arbitrarily high Dc and at the same time 
arbitrarily low key rate. 
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FIG. 1: The set of Bell-diagonal states that satisfies the rank-one Z condition (22a) (left), rank-two Z conditions (22b) or (22c) (center), and 
the union of the two (right). The figures have a maximally entangled state on each vertex and the surfaces have the symmetry of the tetrahedron. 



log 2 [2a2/(l — a\)] does not depend on 0:3 at all. The equa- 
tions for the surfaces of constant Dc are then 

a\ + 2 ■ T Dc a\ = 1. (26) 

These are the equations for ellipses with center in the ori- 
gin, constant ai-semiaxis 1, and D c -dependent a^-semiaxis 
2 (£>c-i)/2_ The surfaces are plotted in Fig. 2. In the figure, 
the ellipse that extends outside the state space and separates 
region A and B is the surface where Dc = 0. Inside that el- 
lipse are thin dashed lines indicating Dc = — 1, — 2, . . ., and 
outside are similar lines indicating Dc = 1,2,.... The two 
other curves relate to symmetric extension which we will deal 
with next. 



B. Symmetric extension for cross sections 

If condition (22a) is satisfied, the corresponding state has 
a symmetric extension. Since the conditions (22b) and (22c) 
only fill the convex hull of this body, we will only need to 
consider the body described by inequality (22a) and its convex 
hull here. 

Unlike the surfaces for constant Dc, the surface of the set 
of extendible states is dependent on a 3 . In comparing sym- 
metric extension to the Dc surfaces, we will be particularly 
interested in three cross sections through the symmetric ex- 
tension surface. One is through the center of the tetrahe- 
dron that defines the state space, where a 3 = (p x = p y ). 
The two others are the two faces of the tetrahedron where 
a 3 = ±(1 - ai)/V2 ( Py = and p x = 0). 

For the cross section where p x — p y , we set a 3 = in 
Eq. (22a) to get the equation 




for the border. This tells us that any state with a 2 = (and 
at the same time a 3 — 0) has symmetric extension, and they 




FIG. 2: Plot of the Bell-diagonal state space as a function of ai and 
ot2, with Q3 projected out. The thin dashed lines indicate the value 
of Dc- The shaded region S corresponds to separable states (for at 
least some C13). Region A is the set of entangled states for which the 
B-steps fail to break a symmetric extension. The border between A 
and B corresponds to Dc = 0. Regions A and B together are the 
entangled states with symmetric extension for all possible values of 
03, while in region C all the states with 03 = have a symmetric 
extension; but some states with other Q3 do not. In region D, no 
states have symmetric extension. The borders between regions B and 
C and regions C and D both have the shape of ellipses. The former is 
described by Eq. (30), while the latter is described by Eq. (28). 
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also happen to be separable. When 02 ^ 0, we get 

4 («i-^) +"2 = 1 (28) 

which describes an ellipse with center in (a.%, 02) = (1/2, 0), 
01-semiaxis 1 /2, and 02-semiaxis 1. In Fig. 2 this is the solid 
curve separating regions C and D. 

For the cases p y = and p x = 0, we insert o 3 = ±(1 — 
Oi)/ \J2 into Eq. (22a) to get 

-s(i( a, -i)' + i aS - 1 )' a0, a9) 

which simplifies to 

/ 1 \ 2 3 

4U-3J +2«2 = 1- (30) 

This describes another ellipse, with center in (1/3,0), a.\- 
semiaxis 2/3, and 02-semiaxis v/2/3. This is the solid line 
separating regions B and C in Fig. 2. 

The outer (0-3 = 0) symmetric extension curve (between C 
and D in Fig. 2) defines a border with no states with symmetric 
extension on the outside (for any 03). This is because if a state 
defined by (0:1,0(2,0:3) has a symmetric extension, so does 
the state defined by (o 1; o 2j — "3) since the states are related 
by local unitaries. Then the convex combination (oi, 02, 0) 
would also have a symmetric extension. The inner symmetric 
extension curve [03 = ±1/V2(1 — 01), between B and C] is 
the border where all the states inside it has symmetric exten- 
sion for all 03, since they can be obtained by mixing the states 
with symmetric extension on the surface of the state space. 

C. Distillability vs. symmetric extension 

We are now in a position to relate Dq to symmetric ex- 
tension. From Fig. 2, it is evident that in most of the state 
space, the surface Dc — 2 lies strictly outside the outer 
border for symmetric extension (the line between C and D). 
Toward the point (1,0), however, all the lines for constant 
Dc, symmetric extension border, and separability border con- 
verge. This is also the state toward which the sequence of 
states after the B-steps converges for the most relevant start- 
ing states (e.g. all states with pj > 0.5, p z > 0). Even 
though this is a separable state, in any neighborhood around it 
there will be states without symmetric extension. By inserting 
Dc — 2 in Eq. (26), the Dc = 2 border can be described 
by a 2 — 2 — 2o 2 =: /(ai). Similarly, the outer border 
for symmetric extension from Eq. (28) can be expressed as 
o 2 = 1 - 4(oi - 1/2) 2 =: .9(01). Taking the difference, 
we get A(o|) = - g(ai) = 2(aj - l) 2 > 0, so the 

Dc = 2 surface is always outside the symmetric extension 
surface, except for the point (1,0) where Dc is not defined. 
Thus, no states for which Dc > 2 has a symmetric exten- 
sion. In a similar fashion, one can show that the Chau border 
Dc = never is outside the inner symmetric extension border 



(between regions B and C) in the interval oi £ [0, 1], which 
is the region where the Chau border is contained in the state 
space. They coincide at the points (0, l/v2) an d (1, 0). Thus, 
any state with Dc < has a symmetric extension. 

To apply this to the six-state and BB84 QKD schemes, 
let us assume that Alice and Bob discard the data specify- 
ing which bits come from which bases, meaning the error 
rates in the different bases are identical. Only one possi- 
ble state is consistent with the observed error rate q, namely, 
q/2 = p x = p y = p z . This immediately yields q m!lx — 
(5 - V5) /10 w 27.64% for D c = 0. 

From the BB84 measurements, only the error rates in the 
x and z basis can be observed, meaning the state is not 
completely determined, only that q = q x = q z for q x := 
p y + p z and q z := p x + p y . If q is below 1/2, the pos- 
sible eigenvalues are (1 — 2q,q,0,q) + 4(1,-1,1,-1) for 
t £ [0, q/2]. When expressed in terms of (01,02,03), this 
becomes (1 -2q,y/2(l - 3q), qV2) + t(0, 2\f2, -2y/2). To 
determine if Dc < for any of the possible states, we min- 
imize 2 Dc = 2o 2 /(l — a 2 ). This amounts to minimizing 
|o 2 |, since oi is fixed by q, and it is obvious by inspection 
that t = gives the minimum. Solving Dc = 0, we find 

<7max = 1/5. 



D. Variations of B-steps 

In our analysis, we have used the B-steps introduced in [19] 
and inspired from classical advantage distillation (CAD) [21]. 
CAD works on blocks of N bits and Alice and Bob both an- 
nounce the parities of all bits with the first bit. They keep the 
first bit if all the parities are equal, otherwise they discard the 
block. Given the announced parities, there are only two pos- 
sible bit strings compatible with the announcements, namely, 
the correct string and the inverted string. It is easy to see that 
when the block size for CAD is N = 2 n , it is equivalent to 
n successful rounds of B-steps (when the whole block is dis- 
carded if any of the B-steps fail). To make sure that even 
for N ^ 2™ CAD cannot break symmetric extension for any 
states were B-steps fail, we can compute the output state af- 
ter CAD. The input state is N copies of a Bell-diagonal state, 
which we think of as a maximally entangled state |(E> + ) which 
has a probability pi for having suffered a a t error on Bob's 
qubit. The output qubit has a bit error (either a x or a y ) iff all 
the qubits in the block had a bit error and it has no bit error 
iff no qubit in the block had a bit error. The other bit error 
patterns are detected and the block is discarded. The output 
qubit has a phase error (a y or <r z ) if an odd number of input 
qubits had a phase error, and no phase error if an even number 
of input qubits had a phase error. So the output qubit is error 
free if and only if an even number of input qubits had a a z 
error and the rest were error free. The probability for this to 
happen given the state of the input qubits is pj AD = pf + 

{%)pr 2 pi + or 4 ^ + ■ ■ = eS 2J ( 2 >r 2 ^- 

This is every second term in the expansion of (pj ± pz) N , 
and by taking the average of the ± cases we get the terms 
we want, pj AD = | ((p/ + p z ) N + (pj — p z ) N ). By making 
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similar arguments, we get p^ AD from the terms with an odd 
number of a z errors, and p^, AD and Py AD from the cases where 
there are a x and a y errors instead of 1 and a z . This gives the 
following generalization of Eqs. (24): 



LJV/2J 



N 



N-2j 2j 



j=0 v 



1 



{(Pi + Pz ) N + {pi- Pz ) n ) 



(31a) 



L(iV-l)/2j 



CAD 



E 

j=0 



N 
2j + l 



iV-(2j+l) 2 j+l 



((p/+p»r-(p/-p,r) 



(31b) 



^ AD - o ((p- + Pv) N + (p- " P»H . ( 31c ) 



§ AD =^(fe+p,) jv -(px-p 3/ n, oid) 



where the sum of these probabilities gives the probability for 
CAD to succeed. From this, it follows directly that D^ AD = 
NDc, so having the liberty to choose block sizes other than 
2" does not help if D c < 0. 

Another observation is that the announcement of any N — 1 
independent parity bits on a block of N bits is equivalent to 
performing CAD on a subset of M < N of those bits. This 
can be seen simply by counting the number of possible strings. 
On the block of N bits, there are 2 N possible strings. Each 
announced parity bit halves this number, so after A — 1 parity 
bits there are only two possible strings left. Any bits that are 
equal in the two strings are therefore completely revealed by 
the announcement. The remaining M bits are all different and 
the CAD on those M bits is the same as announcing that we 
have one of those possible substrings. Hence, nothing that 
generates a bit from N bits by announcing N — 1 independent 
parity bits can break the symmetric extension. 



attempted to improve the thresholds by adding noise in the 
beginning of the procedure, allowing coherent quantum oper- 
ation on one side or measuring in a different basis, but without 
success. Portmann [23] investigated BB84 with the bit error 
detection using random parities but could only prove security 
up to a QBER of 16.9%. We believe that the symmetric ex- 
tension can be a useful tool for narrowing down which type of 
postprocessing, if any, can distill a secret key beyond current 
thresholds. 

In the analysis, we have depended on the fact that the state 
after sifting can be considered to be Bell-diagonal, when one 
only considers the quantum bit error rate in the different bases. 
While the state really is Bell-diagonal for a Pauli channel, it 
may be different in general and this would show up as corre- 
lations in the data where Alice and Bob measure in different 
bases. For other protocols, such as SARG04 [6] and proto- 
cols based on spherical codes [24], the sifting works as a filter 
so the state will not be Bell diagonal even for a Pauli channel. 
In these cases, the twirling procedure may actually turn a state 
without symmetric extension into one that has. Any two-qubit 
pure state can be written in the Bell-basis 



and by choosing \a>j\ = y/pj, twirling will give a Bell- 
diagonal state with eigenvalues pj. If those pj are chosen 
such that the Bell-diagonal state has symmetric extension and 
the pure state is not a product state, the twirling will intro- 
duce a symmetric extension that was not there to begin with. 
The most extreme example of this is when a.j = exp(i7rj/2). 
Then the pure state is maximally entangled and since the cor- 
relations are in the wrong bases, the twirled state is maximally 
mixed. A natural question is then what we can say about the 
symmetric extension for more general states, and this will be 
considered elsewhere [25]. 
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